a question about tst-cancel2

when a pthread is created, th->cancelhandling=0;
then pthread_cancel(th) will only mark 
th->cancelhandling=4(CANCELED_BITMASK) without
calling __pthread_kill(). 
Where could I find the place to execute the cancel buf 
of th pthread? th pthread  calls sys_exit() directly 
after return according to clone.S  

Do I miss sth? thanks.

boris